<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">Speaking of which, if you're running
any kind of script on your site (WordPress, etc) make sure it is
up to date. If there is a 0-day exploit out for it, the script
kiddies are going down the list on Google searching for "Powered
by WordPress" and seeing if your server is open to exploits. Most
of the time this isnt caused by a single IP address, it's usually
a botnet from around the world, but sometimes it can be.<br>
<br>
Any way you could post some of the logs? Like show what kind of
http request they were making? <br>
<br>
On 3/18/2013 3:01 PM, Andrew Beals wrote:<br>
</div>
<blockquote
cite="mid:CAJ=kVsKmGLrxy=_T3mHhXXhcY0tbU+Wk_hQqN=0PtopjbHUx-A@mail.gmail.com"
type="cite">
<p>It his pipe is full, then he has bigger problems than that
which J. Random Unix Jock can explain over a mass e-mail.
Especially when yum knows not of fail2ban. </p>
<p>Serving 404 pages to script kiddies shouldn't Bork a server. It
shouldn't even put an appreciable load on it. Script kiddies are
here to stay, thanks to the fringe members of the "information
should be free" crowd. (Just as an example, there appear to be
about 1.6k copies of The Anarchist Cookbook out there, ready for
downloading.) </p>
<p>Andy<br>
Ps. There are too many kittens - please spay/neuter your pets. </p>
<p>Any typos are the direct result of Swiftkey X's autocorrect
function. </p>
<div class="gmail_quote">On Mar 18, 2013 2:40 PM, "Billy Crook"
<<a moz-do-not-send="true" href="mailto:billycrook@gmail.com">billycrook@gmail.com</a>>
wrote:<br type="attribution">
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
Every time you use a route table as a firewall, God kills a
kitten.<br>
<br>
If you want a firewall, use..... a firewall. iptables is the
command.<br>
<br>
If you want something that scales, and won't require your time
to<br>
maintain a shitlist of IPs; use fail2ban, and it will manage
the list<br>
per your specifications.<br>
<br>
Most likely, your DoS is apache-local. i.e. they aren't
actually<br>
flooding your entire pipe. If you use fail2ban/iptables, this
should<br>
fix you right up.<br>
<br>
If they are flooding your actual pipe, you need to apply the
filter on<br>
the far end of your pipe. i.e. Get your ISP (or a new isp)
that will<br>
let you administer an ACL on the router on THEIR side of your
line.<br>
Or get a DDoS prevention service. Blocking on the sonic wall
will<br>
have NO affect on a flood if the sonic wall is at the same
site as the<br>
targeted server.<br>
<br>
Fail2ban can integrate with this remote filtering too. You
simply<br>
modify fail2ban's 'action' to call a script that adds the IP
upstream.<br>
<br>
On Mon, Mar 18, 2013 at 2:27 PM, Andrew Beals <<a
moz-do-not-send="true" href="mailto:andrew.beals@gmail.com">andrew.beals@gmail.com</a>>
wrote:<br>
> If they're coming from just the single IP, then
black-hole'ing their IP is<br>
> easier. If the address they're coming from is
128.115.1.1, then simply<br>
> paste this at a shell prompt and give it your password
when sudo asks for<br>
> it:<br>
><br>
> sudo route add 128.115.1.1 gw 127.0.0.1 lo<br>
><br>
> This will cause all packets destined to go back to them
to get dropped on<br>
> the floor and should be sufficient. You'd really prefer
to do this (or just<br>
> add them to the naughty list which is something that I
believe the SW can<br>
> do, even with ancient builds of their SW) on your
SonicWall box, but you can<br>
> get away with doing it on your server.<br>
><br>
> Adding an IP tables (again, if you can't convince your SW
to just drop<br>
> packets from them) is more efficient, of course, but it's
hairier to set up.<br>
><br>
><br>
><br>
> On Mon, Mar 18, 2013 at 2:19 PM, J. Wade Michaelis<br>
> <<a moz-do-not-send="true"
href="mailto:jwade@userfriendlytech.net">jwade@userfriendlytech.net</a>>
wrote:<br>
>><br>
>> I have a CentOS web server that has recently been
brought to a halt on two<br>
>> separate occasions. Checking the access.log, it
appears that it was a<br>
>> Denial of Service (DOS) attack (hundreds of HTTP
requests in a very short<br>
>> time, all from a single IP address).<br>
>><br>
>> I want to prevent these types of attacks from
bringing the server to its<br>
>> knees. We have a hardware firewall (SonicWall) in
place, but it isn't quite<br>
>> new enough to run the firmware that allows
rate-limiting.<br>
>><br>
>> I have found a number of tutorials that show how to
do this type of thing<br>
>> with IPTABLES. Is there a better solution?<br>
>><br>
>> Supposing I go with IPTABLES, do I need to include
rules to allow FTP and<br>
>> SSH (the only other services on the server)?<br>
>><br>
>> Would any of you be willing to assist me with this?<br>
>><br>
>> Thanks,<br>
>> ~ j.<br>
>> <a moz-do-not-send="true"
href="mailto:jwade@userfriendlytech.net">jwade@userfriendlytech.net</a><br>
>><br>
>> _______________________________________________<br>
>> KCLUG mailing list<br>
>> <a moz-do-not-send="true"
href="mailto:KCLUG@kclug.org">KCLUG@kclug.org</a><br>
>> <a moz-do-not-send="true"
href="http://kclug.org/mailman/listinfo/kclug"
target="_blank">http://kclug.org/mailman/listinfo/kclug</a><br>
><br>
><br>
><br>
> _______________________________________________<br>
> KCLUG mailing list<br>
> <a moz-do-not-send="true" href="mailto:KCLUG@kclug.org">KCLUG@kclug.org</a><br>
> <a moz-do-not-send="true"
href="http://kclug.org/mailman/listinfo/kclug"
target="_blank">http://kclug.org/mailman/listinfo/kclug</a><br>
</blockquote>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
KCLUG mailing list
<a class="moz-txt-link-abbreviated" href="mailto:KCLUG@kclug.org">KCLUG@kclug.org</a>
<a class="moz-txt-link-freetext" href="http://kclug.org/mailman/listinfo/kclug">http://kclug.org/mailman/listinfo/kclug</a></pre>
</blockquote>
<br>
</body>
</html>